--wip-- [skip ci]

ql/src/go.qll

@@ -34,6 +34,7 @@ import semmle.go.frameworks.HTTP
 import semmle.go.frameworks.Macaron
 import semmle.go.frameworks.Mux
 import semmle.go.frameworks.NoSQL
+import semmle.go.frameworks.Protobuf
 import semmle.go.frameworks.SQL
 import semmle.go.frameworks.Stdlib
 import semmle.go.frameworks.SystemCommandExecutors

ql/src/semmle/go/frameworks/Protobuf.qll

@@ -0,0 +1,88 @@
+/** Provides models of commonly used functions and types in the `google.golang.org/protobuf/proto` package. */
+
+import go
+
+/** Provides models of commonly used functions and types in the `google.golang.org/protobuf/proto` package. */
+module Protobuf {
+  /** The `Marshal`, `MarshalAppend`, or `MarshalState` functions in the `google.golang.org/protobuf/proto` package. */
+  private class MarshalFunction extends TaintTracking::FunctionModel, MarshalingFunction::Range {
+    string name;
+
+    MarshalFunction() {
+      name = ["Marshal", "MarshalAppend", "MarshalState"] and
+      this.hasQualifiedName("github.com/golang/protobuf/proto", name)
+    }
+
+    override predicate hasTaintFlow(DataFlow::FunctionInput inp, DataFlow::FunctionOutput outp) {
+      inp = getAnInput() and outp = getOutput()
+    }
+
+    override DataFlow::FunctionInput getAnInput() {
+      if name = "MarshalAppend" then result.isParameter(1) else result.isParameter(0)
+    }
+
+    override DataFlow::FunctionOutput getOutput() {
+      name = "MarshalAppend" and result.isParameter(0)
+      or
+      result.isResult(0)
+    }
+
+    override string getFormat() { result = "protobuf" }
+  }
+
+  /** The `Unmarshal` or `UnmarshalState` functions in the `google.golang.org/protobuf/proto` package. */
+  class UnmarshalFunction extends TaintTracking::FunctionModel, UnmarshalingFunction::Range {
+    string name;
+
+    UnmarshalFunction() {
+      name = ["Unmarshal", "UnmarshalState"] and
+      this.hasQualifiedName("github.com/golang/protobuf/proto", name)
+    }
+
+    override predicate hasTaintFlow(DataFlow::FunctionInput inp, DataFlow::FunctionOutput outp) {
+      inp = getAnInput() and outp = getOutput()
+    }
+
+    override DataFlow::FunctionInput getAnInput() { result.isParameter(0) }
+
+    override DataFlow::FunctionOutput getOutput() { result.isParameter(1) }
+
+    override string getFormat() { result = "protobuf" }
+  }
+
+  /** The `Merge` function in the `google.golang.org/protobuf/proto` package. */
+  private class MergeFunction extends TaintTracking::FunctionModel {
+    MergeFunction() { this.hasQualifiedName("github.com/golang/protobuf/proto", "Merge") }
+
+    override predicate hasTaintFlow(FunctionInput inp, FunctionOutput outp) {
+      inp.isParameter(_) and outp.isParameter(0)
+    }
+  }
+
+  /** A protobuf `Message` type. */
+  class MessageType extends Type {
+    MessageType() {
+      this.implements("google.golang.org/protobuf/reflect/protoreflect", "ProtoMessage")
+    }
+  }
+
+  /** The `Clone` method of a protobuf `Message` type. */
+  private class MessageCloneMethod extends DataFlow::FunctionModel, Method {
+    MessageCloneMethod() { this = any(MessageType msg).getMethod("Clone") }
+
+    override predicate hasDataFlow(FunctionInput inp, FunctionOutput outp) {
+      inp.isParameter(0) and outp.isResult()
+    }
+  }
+
+  /** A `Get` method of a protobuf `Message` type. */
+  private class GetMethod extends DataFlow::FunctionModel, Method {
+    GetMethod() {
+      exists(string name | name.matches("Get%") | this = any(MessageType msg).getMethod(name))
+    }
+
+    override predicate hasDataFlow(FunctionInput inp, FunctionOutput outp) {
+      inp.isReceiver() and outp.isResult()
+    }
+  }
+}

ql/test/library-tests/semmle/go/frameworks/Protobuf/FunctionModel.expected

@@ -0,0 +1,4 @@
+| proto.go:27:10:27:21 | reflectedXSS | proto.go:27:10:27:38 | call to GetDescription |
+| proto.go:28:12:28:23 | reflectedXSS | proto.go:28:12:28:35 | call to GetAlerts |
+| proto.go:30:35:30:46 | reflectedXSS | proto.go:30:2:30:47 | ... := ...[0] |
+| proto.go:36:24:36:33 | serialized | proto.go:35:2:35:13 | definition of deserialized |

ql/test/library-tests/semmle/go/frameworks/Protobuf/FunctionModel.ql

@@ -0,0 +1,12 @@
+import go
+
+from DataFlow::Node pred, DataFlow::Node succ
+where
+  exists(FunctionInput inp, FunctionOutput outp, DataFlow::CallNode call |
+    exists(TaintTracking::FunctionModel f | call.getTarget() = f | f.hasTaintFlow(inp, outp))
+    or
+    exists(DataFlow::FunctionModel f | call.getTarget() = f | f.hasDataFlow(inp, outp))
+  |
+    pred = inp.getEntryNode(call) and succ = outp.getExitNode(call)
+  )
+select pred, succ

ql/test/library-tests/semmle/go/frameworks/Protobuf/MessageType.expected

@@ -0,0 +1,3 @@
+| * Query |
+| * QuerySuite |
+| * Query_Alert |

ql/test/library-tests/semmle/go/frameworks/Protobuf/MessageType.ql

@@ -0,0 +1,5 @@
+import go
+
+from Protobuf::MessageType msgTyp
+where msgTyp.(PointerType).getBaseType().hasQualifiedName("codeql-go-tests/protobuf/protos/query", _)
+select msgTyp.pp()

ql/test/library-tests/semmle/go/frameworks/Protobuf/go.mod

@@ -0,0 +1,9 @@
+module codeql-go-tests/protobuf
+
+go 1.14
+
+require (
+	github.com/golang/protobuf v1.4.2
+	google.golang.org/protobuf v1.23.0
+)
+

ql/test/library-tests/semmle/go/frameworks/Protobuf/proto.go

@@ -0,0 +1,46 @@
+//go:generate protoc -I=protos --go_out=. protos/query.proto
+//go:generate depstubber -vendor github.com/golang/protobuf/proto Message Marshal,Unmarshal,ProtoPackageIsVersion4
+//go:generate depstubber -vendor google.golang.org/protobuf/reflect/protoreflect EnumDescriptor,EnumType,EnumNumber,Message,FileDescriptor
+// the following is done by hand due to limiations of depstubber
+//#go:generate depstubber -vendor google.golang.org/protobuf/runtime/protoimpl MessageState,SizeCache,UnknownFields,Pointer,EnforceVersion MinVersion,MaxVersion,UnsafeEnabled,X
+//go:generate depstubber -vendor google.golang.org/protobuf/runtime/protoiface MessageV1
+
+package main
+
+import (
+	"fmt"
+	"github.com/golang/protobuf/proto"
+
+	"codeql-go-tests/protobuf/protos/query"
+)
+
+func main() {
+	reflectedXSS := &query.Query{
+		Description: "Writing user input directly to an HTTP response allows for a cross-site scripting vulnerability.",
+		Id:          "go/reflected-xss",
+		Alerts: []*query.Query_Alert{
+			&query.Query_Alert{
+				Msg: "Cross-site scripting vulnerability due to user-provided value.",
+				Loc: 23425135,
+			},
+		},
+	}
+
+	desc := reflectedXSS.GetDescription()
+	alerts := reflectedXSS.GetAlerts()
+
+	serialized, err := proto.Marshal(reflectedXSS)
+	if err != nil {
+		// ...
+	}
+
+	deserialized := &query.Query{}
+	err = proto.Unmarshal(serialized, deserialized)
+	if err != nil {
+		// error handling
+	}
+
+	fmt.Println(desc, alerts)
+
+	fmt.Println(reflectedXSS.Clone())
+}

ql/test/library-tests/semmle/go/frameworks/Protobuf/protos/codeql-go-tests/protobuf/proto/query.pb.go

@@ -0,0 +1,353 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.24.0-devel
+// 	protoc        v3.12.0
+// source: query.proto
+
+package proto
+
+import (
+	proto "github.com/golang/protobuf/proto"
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// This is a compile-time assertion that a sufficiently up-to-date version
+// of the legacy proto package is being used.
+const _ = proto.ProtoPackageIsVersion4
+
+type Query_Severity int32
+
+const (
+	Query_ERROR   Query_Severity = 0
+	Query_WARNING Query_Severity = 1
+)
+
+// Enum value maps for Query_Severity.
+var (
+	Query_Severity_name = map[int32]string{
+		0: "ERROR",
+		1: "WARNING",
+	}
+	Query_Severity_value = map[string]int32{
+		"ERROR":   0,
+		"WARNING": 1,
+	}
+)
+
+func (x Query_Severity) Enum() *Query_Severity {
+	p := new(Query_Severity)
+	*p = x
+	return p
+}
+
+func (x Query_Severity) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (Query_Severity) Descriptor() protoreflect.EnumDescriptor {
+	return file_query_proto_enumTypes[0].Descriptor()
+}
+
+func (Query_Severity) Type() protoreflect.EnumType {
+	return &file_query_proto_enumTypes[0]
+}
+
+func (x Query_Severity) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use Query_Severity.Descriptor instead.
+func (Query_Severity) EnumDescriptor() ([]byte, []int) {
+	return file_query_proto_rawDescGZIP(), []int{0, 0}
+}
+
+type Query struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Msg    string         `protobuf:"bytes,1,opt,name=msg,proto3" json:"msg,omitempty"`
+	Id     string         `protobuf:"bytes,2,opt,name=id,proto3" json:"id,omitempty"`
+	Alerts []*Query_Alert `protobuf:"bytes,4,rep,name=alerts,proto3" json:"alerts,omitempty"`
+}
+
+func (x *Query) Reset() {
+	*x = Query{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_query_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Query) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Query) ProtoMessage() {}
+
+func (x *Query) ProtoReflect() protoreflect.Message {
+	mi := &file_query_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Query.ProtoReflect.Descriptor instead.
+func (*Query) Descriptor() ([]byte, []int) {
+	return file_query_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *Query) GetMsg() string {
+	if x != nil {
+		return x.Msg
+	}
+	return ""
+}
+
+func (x *Query) GetId() string {
+	if x != nil {
+		return x.Id
+	}
+	return ""
+}
+
+func (x *Query) GetAlerts() []*Query_Alert {
+	if x != nil {
+		return x.Alerts
+	}
+	return nil
+}
+
+type QuerySuite struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Queries []*Query `protobuf:"bytes,1,rep,name=queries,proto3" json:"queries,omitempty"`
+}
+
+func (x *QuerySuite) Reset() {
+	*x = QuerySuite{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_query_proto_msgTypes[1]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *QuerySuite) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*QuerySuite) ProtoMessage() {}
+
+func (x *QuerySuite) ProtoReflect() protoreflect.Message {
+	mi := &file_query_proto_msgTypes[1]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use QuerySuite.ProtoReflect.Descriptor instead.
+func (*QuerySuite) Descriptor() ([]byte, []int) {
+	return file_query_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *QuerySuite) GetQueries() []*Query {
+	if x != nil {
+		return x.Queries
+	}
+	return nil
+}
+
+type Query_Alert struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Msg string `protobuf:"bytes,1,opt,name=msg,proto3" json:"msg,omitempty"`
+	Loc int64  `protobuf:"varint,2,opt,name=loc,proto3" json:"loc,omitempty"`
+}
+
+func (x *Query_Alert) Reset() {
+	*x = Query_Alert{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_query_proto_msgTypes[2]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Query_Alert) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Query_Alert) ProtoMessage() {}
+
+func (x *Query_Alert) ProtoReflect() protoreflect.Message {
+	mi := &file_query_proto_msgTypes[2]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Query_Alert.ProtoReflect.Descriptor instead.
+func (*Query_Alert) Descriptor() ([]byte, []int) {
+	return file_query_proto_rawDescGZIP(), []int{0, 0}
+}
+
+func (x *Query_Alert) GetMsg() string {
+	if x != nil {
+		return x.Msg
+	}
+	return ""
+}
+
+func (x *Query_Alert) GetLoc() int64 {
+	if x != nil {
+		return x.Loc
+	}
+	return 0
+}
+
+var File_query_proto protoreflect.FileDescriptor
+
+var file_query_proto_rawDesc = []byte{
+	0x0a, 0x0b, 0x71, 0x75, 0x65, 0x72, 0x79, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0xa0, 0x01,
+	0x0a, 0x05, 0x51, 0x75, 0x65, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6d, 0x73, 0x67, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6d, 0x73, 0x67, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x24, 0x0a, 0x06, 0x61, 0x6c, 0x65,
+	0x72, 0x74, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x0c, 0x2e, 0x51, 0x75, 0x65, 0x72,
+	0x79, 0x2e, 0x41, 0x6c, 0x65, 0x72, 0x74, 0x52, 0x06, 0x61, 0x6c, 0x65, 0x72, 0x74, 0x73, 0x1a,
+	0x2b, 0x0a, 0x05, 0x41, 0x6c, 0x65, 0x72, 0x74, 0x12, 0x10, 0x0a, 0x03, 0x6d, 0x73, 0x67, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6d, 0x73, 0x67, 0x12, 0x10, 0x0a, 0x03, 0x6c, 0x6f,
+	0x63, 0x18, 0x02, 0x20, 0x01, 0x28, 0x03, 0x52, 0x03, 0x6c, 0x6f, 0x63, 0x22, 0x22, 0x0a, 0x08,
+	0x53, 0x65, 0x76, 0x65, 0x72, 0x69, 0x74, 0x79, 0x12, 0x09, 0x0a, 0x05, 0x45, 0x52, 0x52, 0x4f,
+	0x52, 0x10, 0x00, 0x12, 0x0b, 0x0a, 0x07, 0x57, 0x41, 0x52, 0x4e, 0x49, 0x4e, 0x47, 0x10, 0x01,
+	0x22, 0x2e, 0x0a, 0x0a, 0x51, 0x75, 0x65, 0x72, 0x79, 0x53, 0x75, 0x69, 0x74, 0x65, 0x12, 0x20,
+	0x0a, 0x07, 0x71, 0x75, 0x65, 0x72, 0x69, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32,
+	0x06, 0x2e, 0x51, 0x75, 0x65, 0x72, 0x79, 0x52, 0x07, 0x71, 0x75, 0x65, 0x72, 0x69, 0x65, 0x73,
+	0x42, 0x20, 0x5a, 0x1e, 0x63, 0x6f, 0x64, 0x65, 0x71, 0x6c, 0x2d, 0x67, 0x6f, 0x2d, 0x74, 0x65,
+	0x73, 0x74, 0x73, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x70, 0x72, 0x6f,
+	0x74, 0x6f, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_query_proto_rawDescOnce sync.Once
+	file_query_proto_rawDescData = file_query_proto_rawDesc
+)
+
+func file_query_proto_rawDescGZIP() []byte {
+	file_query_proto_rawDescOnce.Do(func() {
+		file_query_proto_rawDescData = protoimpl.X.CompressGZIP(file_query_proto_rawDescData)
+	})
+	return file_query_proto_rawDescData
+}
+
+var file_query_proto_enumTypes = make([]protoimpl.EnumInfo, 1)
+var file_query_proto_msgTypes = make([]protoimpl.MessageInfo, 3)
+var file_query_proto_goTypes = []interface{}{
+	(Query_Severity)(0), // 0: Query.Severity
+	(*Query)(nil),       // 1: Query
+	(*QuerySuite)(nil),  // 2: QuerySuite
+	(*Query_Alert)(nil), // 3: Query.Alert
+}
+var file_query_proto_depIdxs = []int32{
+	3, // 0: Query.alerts:type_name -> Query.Alert
+	1, // 1: QuerySuite.queries:type_name -> Query
+	2, // [2:2] is the sub-list for method output_type
+	2, // [2:2] is the sub-list for method input_type
+	2, // [2:2] is the sub-list for extension type_name
+	2, // [2:2] is the sub-list for extension extendee
+	0, // [0:2] is the sub-list for field type_name
+}
+
+func init() { file_query_proto_init() }
+func file_query_proto_init() {
+	if File_query_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_query_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Query); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_query_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*QuerySuite); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_query_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Query_Alert); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_query_proto_rawDesc,
+			NumEnums:      1,
+			NumMessages:   3,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_query_proto_goTypes,
+		DependencyIndexes: file_query_proto_depIdxs,
+		EnumInfos:         file_query_proto_enumTypes,
+		MessageInfos:      file_query_proto_msgTypes,
+	}.Build()
+	File_query_proto = out.File
+	file_query_proto_rawDesc = nil
+	file_query_proto_goTypes = nil
+	file_query_proto_depIdxs = nil
+}

ql/test/library-tests/semmle/go/frameworks/Protobuf/protos/codeql-go-tests/protobuf/protos/query.pb.go

@@ -0,0 +1,354 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.24.0-devel
+// 	protoc        v3.12.0
+// source: query.proto
+
+package protos
+
+import (
+	proto "github.com/golang/protobuf/proto"
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// This is a compile-time assertion that a sufficiently up-to-date version
+// of the legacy proto package is being used.
+const _ = proto.ProtoPackageIsVersion4
+
+type Query_Severity int32
+
+const (
+	Query_ERROR   Query_Severity = 0
+	Query_WARNING Query_Severity = 1
+)
+
+// Enum value maps for Query_Severity.
+var (
+	Query_Severity_name = map[int32]string{
+		0: "ERROR",
+		1: "WARNING",
+	}
+	Query_Severity_value = map[string]int32{
+		"ERROR":   0,
+		"WARNING": 1,
+	}
+)
+
+func (x Query_Severity) Enum() *Query_Severity {
+	p := new(Query_Severity)
+	*p = x
+	return p
+}
+
+func (x Query_Severity) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (Query_Severity) Descriptor() protoreflect.EnumDescriptor {
+	return file_query_proto_enumTypes[0].Descriptor()
+}
+
+func (Query_Severity) Type() protoreflect.EnumType {
+	return &file_query_proto_enumTypes[0]
+}
+
+func (x Query_Severity) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use Query_Severity.Descriptor instead.
+func (Query_Severity) EnumDescriptor() ([]byte, []int) {
+	return file_query_proto_rawDescGZIP(), []int{0, 0}
+}
+
+type Query struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Description string         `protobuf:"bytes,1,opt,name=description,proto3" json:"description,omitempty"`
+	Id          string         `protobuf:"bytes,2,opt,name=id,proto3" json:"id,omitempty"`
+	Alerts      []*Query_Alert `protobuf:"bytes,4,rep,name=alerts,proto3" json:"alerts,omitempty"`
+}
+
+func (x *Query) Reset() {
+	*x = Query{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_query_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Query) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Query) ProtoMessage() {}
+
+func (x *Query) ProtoReflect() protoreflect.Message {
+	mi := &file_query_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Query.ProtoReflect.Descriptor instead.
+func (*Query) Descriptor() ([]byte, []int) {
+	return file_query_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *Query) GetDescription() string {
+	if x != nil {
+		return x.Description
+	}
+	return ""
+}
+
+func (x *Query) GetId() string {
+	if x != nil {
+		return x.Id
+	}
+	return ""
+}
+
+func (x *Query) GetAlerts() []*Query_Alert {
+	if x != nil {
+		return x.Alerts
+	}
+	return nil
+}
+
+type QuerySuite struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Queries []*Query `protobuf:"bytes,1,rep,name=queries,proto3" json:"queries,omitempty"`
+}
+
+func (x *QuerySuite) Reset() {
+	*x = QuerySuite{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_query_proto_msgTypes[1]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *QuerySuite) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*QuerySuite) ProtoMessage() {}
+
+func (x *QuerySuite) ProtoReflect() protoreflect.Message {
+	mi := &file_query_proto_msgTypes[1]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use QuerySuite.ProtoReflect.Descriptor instead.
+func (*QuerySuite) Descriptor() ([]byte, []int) {
+	return file_query_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *QuerySuite) GetQueries() []*Query {
+	if x != nil {
+		return x.Queries
+	}
+	return nil
+}
+
+type Query_Alert struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Msg string `protobuf:"bytes,1,opt,name=msg,proto3" json:"msg,omitempty"`
+	Loc int64  `protobuf:"varint,2,opt,name=loc,proto3" json:"loc,omitempty"`
+}
+
+func (x *Query_Alert) Reset() {
+	*x = Query_Alert{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_query_proto_msgTypes[2]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Query_Alert) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Query_Alert) ProtoMessage() {}
+
+func (x *Query_Alert) ProtoReflect() protoreflect.Message {
+	mi := &file_query_proto_msgTypes[2]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Query_Alert.ProtoReflect.Descriptor instead.
+func (*Query_Alert) Descriptor() ([]byte, []int) {
+	return file_query_proto_rawDescGZIP(), []int{0, 0}
+}
+
+func (x *Query_Alert) GetMsg() string {
+	if x != nil {
+		return x.Msg
+	}
+	return ""
+}
+
+func (x *Query_Alert) GetLoc() int64 {
+	if x != nil {
+		return x.Loc
+	}
+	return 0
+}
+
+var File_query_proto protoreflect.FileDescriptor
+
+var file_query_proto_rawDesc = []byte{
+	0x0a, 0x0b, 0x71, 0x75, 0x65, 0x72, 0x79, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0xb0, 0x01,
+	0x0a, 0x05, 0x51, 0x75, 0x65, 0x72, 0x79, 0x12, 0x20, 0x0a, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72,
+	0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x64, 0x65,
+	0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x24, 0x0a, 0x06, 0x61, 0x6c, 0x65,
+	0x72, 0x74, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x0c, 0x2e, 0x51, 0x75, 0x65, 0x72,
+	0x79, 0x2e, 0x41, 0x6c, 0x65, 0x72, 0x74, 0x52, 0x06, 0x61, 0x6c, 0x65, 0x72, 0x74, 0x73, 0x1a,
+	0x2b, 0x0a, 0x05, 0x41, 0x6c, 0x65, 0x72, 0x74, 0x12, 0x10, 0x0a, 0x03, 0x6d, 0x73, 0x67, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6d, 0x73, 0x67, 0x12, 0x10, 0x0a, 0x03, 0x6c, 0x6f,
+	0x63, 0x18, 0x02, 0x20, 0x01, 0x28, 0x03, 0x52, 0x03, 0x6c, 0x6f, 0x63, 0x22, 0x22, 0x0a, 0x08,
+	0x53, 0x65, 0x76, 0x65, 0x72, 0x69, 0x74, 0x79, 0x12, 0x09, 0x0a, 0x05, 0x45, 0x52, 0x52, 0x4f,
+	0x52, 0x10, 0x00, 0x12, 0x0b, 0x0a, 0x07, 0x57, 0x41, 0x52, 0x4e, 0x49, 0x4e, 0x47, 0x10, 0x01,
+	0x22, 0x2e, 0x0a, 0x0a, 0x51, 0x75, 0x65, 0x72, 0x79, 0x53, 0x75, 0x69, 0x74, 0x65, 0x12, 0x20,
+	0x0a, 0x07, 0x71, 0x75, 0x65, 0x72, 0x69, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32,
+	0x06, 0x2e, 0x51, 0x75, 0x65, 0x72, 0x79, 0x52, 0x07, 0x71, 0x75, 0x65, 0x72, 0x69, 0x65, 0x73,
+	0x42, 0x21, 0x5a, 0x1f, 0x63, 0x6f, 0x64, 0x65, 0x71, 0x6c, 0x2d, 0x67, 0x6f, 0x2d, 0x74, 0x65,
+	0x73, 0x74, 0x73, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x70, 0x72, 0x6f,
+	0x74, 0x6f, 0x73, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_query_proto_rawDescOnce sync.Once
+	file_query_proto_rawDescData = file_query_proto_rawDesc
+)
+
+func file_query_proto_rawDescGZIP() []byte {
+	file_query_proto_rawDescOnce.Do(func() {
+		file_query_proto_rawDescData = protoimpl.X.CompressGZIP(file_query_proto_rawDescData)
+	})
+	return file_query_proto_rawDescData
+}
+
+var file_query_proto_enumTypes = make([]protoimpl.EnumInfo, 1)
+var file_query_proto_msgTypes = make([]protoimpl.MessageInfo, 3)
+var file_query_proto_goTypes = []interface{}{
+	(Query_Severity)(0), // 0: Query.Severity
+	(*Query)(nil),       // 1: Query
+	(*QuerySuite)(nil),  // 2: QuerySuite
+	(*Query_Alert)(nil), // 3: Query.Alert
+}
+var file_query_proto_depIdxs = []int32{
+	3, // 0: Query.alerts:type_name -> Query.Alert
+	1, // 1: QuerySuite.queries:type_name -> Query
+	2, // [2:2] is the sub-list for method output_type
+	2, // [2:2] is the sub-list for method input_type
+	2, // [2:2] is the sub-list for extension type_name
+	2, // [2:2] is the sub-list for extension extendee
+	0, // [0:2] is the sub-list for field type_name
+}
+
+func init() { file_query_proto_init() }
+func file_query_proto_init() {
+	if File_query_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_query_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Query); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_query_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*QuerySuite); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_query_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Query_Alert); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_query_proto_rawDesc,
+			NumEnums:      1,
+			NumMessages:   3,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_query_proto_goTypes,
+		DependencyIndexes: file_query_proto_depIdxs,
+		EnumInfos:         file_query_proto_enumTypes,
+		MessageInfos:      file_query_proto_msgTypes,
+	}.Build()
+	File_query_proto = out.File
+	file_query_proto_rawDesc = nil
+	file_query_proto_goTypes = nil
+	file_query_proto_depIdxs = nil
+}

ql/test/library-tests/semmle/go/frameworks/Protobuf/protos/protos/query/query.pb.go

@@ -0,0 +1,353 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.24.0-devel
+// 	protoc        v3.12.0
+// source: query.proto
+
+package query
+
+import (
+	proto "github.com/golang/protobuf/proto"
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// This is a compile-time assertion that a sufficiently up-to-date version
+// of the legacy proto package is being used.
+const _ = proto.ProtoPackageIsVersion4
+
+type Query_Severity int32
+
+const (
+	Query_ERROR   Query_Severity = 0
+	Query_WARNING Query_Severity = 1
+)
+
+// Enum value maps for Query_Severity.
+var (
+	Query_Severity_name = map[int32]string{
+		0: "ERROR",
+		1: "WARNING",
+	}
+	Query_Severity_value = map[string]int32{
+		"ERROR":   0,
+		"WARNING": 1,
+	}
+)
+
+func (x Query_Severity) Enum() *Query_Severity {
+	p := new(Query_Severity)
+	*p = x
+	return p
+}
+
+func (x Query_Severity) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (Query_Severity) Descriptor() protoreflect.EnumDescriptor {
+	return file_query_proto_enumTypes[0].Descriptor()
+}
+
+func (Query_Severity) Type() protoreflect.EnumType {
+	return &file_query_proto_enumTypes[0]
+}
+
+func (x Query_Severity) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use Query_Severity.Descriptor instead.
+func (Query_Severity) EnumDescriptor() ([]byte, []int) {
+	return file_query_proto_rawDescGZIP(), []int{0, 0}
+}
+
+type Query struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Description string         `protobuf:"bytes,1,opt,name=description,proto3" json:"description,omitempty"`
+	Id          string         `protobuf:"bytes,2,opt,name=id,proto3" json:"id,omitempty"`
+	Alerts      []*Query_Alert `protobuf:"bytes,4,rep,name=alerts,proto3" json:"alerts,omitempty"`
+}
+
+func (x *Query) Reset() {
+	*x = Query{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_query_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Query) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Query) ProtoMessage() {}
+
+func (x *Query) ProtoReflect() protoreflect.Message {
+	mi := &file_query_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Query.ProtoReflect.Descriptor instead.
+func (*Query) Descriptor() ([]byte, []int) {
+	return file_query_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *Query) GetDescription() string {
+	if x != nil {
+		return x.Description
+	}
+	return ""
+}
+
+func (x *Query) GetId() string {
+	if x != nil {
+		return x.Id
+	}
+	return ""
+}
+
+func (x *Query) GetAlerts() []*Query_Alert {
+	if x != nil {
+		return x.Alerts
+	}
+	return nil
+}
+
+type QuerySuite struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Queries []*Query `protobuf:"bytes,1,rep,name=queries,proto3" json:"queries,omitempty"`
+}
+
+func (x *QuerySuite) Reset() {
+	*x = QuerySuite{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_query_proto_msgTypes[1]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *QuerySuite) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*QuerySuite) ProtoMessage() {}
+
+func (x *QuerySuite) ProtoReflect() protoreflect.Message {
+	mi := &file_query_proto_msgTypes[1]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use QuerySuite.ProtoReflect.Descriptor instead.
+func (*QuerySuite) Descriptor() ([]byte, []int) {
+	return file_query_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *QuerySuite) GetQueries() []*Query {
+	if x != nil {
+		return x.Queries
+	}
+	return nil
+}
+
+type Query_Alert struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Msg string `protobuf:"bytes,1,opt,name=msg,proto3" json:"msg,omitempty"`
+	Loc int64  `protobuf:"varint,2,opt,name=loc,proto3" json:"loc,omitempty"`
+}
+
+func (x *Query_Alert) Reset() {
+	*x = Query_Alert{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_query_proto_msgTypes[2]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Query_Alert) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Query_Alert) ProtoMessage() {}
+
+func (x *Query_Alert) ProtoReflect() protoreflect.Message {
+	mi := &file_query_proto_msgTypes[2]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Query_Alert.ProtoReflect.Descriptor instead.
+func (*Query_Alert) Descriptor() ([]byte, []int) {
+	return file_query_proto_rawDescGZIP(), []int{0, 0}
+}
+
+func (x *Query_Alert) GetMsg() string {
+	if x != nil {
+		return x.Msg
+	}
+	return ""
+}
+
+func (x *Query_Alert) GetLoc() int64 {
+	if x != nil {
+		return x.Loc
+	}
+	return 0
+}
+
+var File_query_proto protoreflect.FileDescriptor
+
+var file_query_proto_rawDesc = []byte{
+	0x0a, 0x0b, 0x71, 0x75, 0x65, 0x72, 0x79, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0xb0, 0x01,
+	0x0a, 0x05, 0x51, 0x75, 0x65, 0x72, 0x79, 0x12, 0x20, 0x0a, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72,
+	0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x64, 0x65,
+	0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x24, 0x0a, 0x06, 0x61, 0x6c, 0x65,
+	0x72, 0x74, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x0c, 0x2e, 0x51, 0x75, 0x65, 0x72,
+	0x79, 0x2e, 0x41, 0x6c, 0x65, 0x72, 0x74, 0x52, 0x06, 0x61, 0x6c, 0x65, 0x72, 0x74, 0x73, 0x1a,
+	0x2b, 0x0a, 0x05, 0x41, 0x6c, 0x65, 0x72, 0x74, 0x12, 0x10, 0x0a, 0x03, 0x6d, 0x73, 0x67, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6d, 0x73, 0x67, 0x12, 0x10, 0x0a, 0x03, 0x6c, 0x6f,
+	0x63, 0x18, 0x02, 0x20, 0x01, 0x28, 0x03, 0x52, 0x03, 0x6c, 0x6f, 0x63, 0x22, 0x22, 0x0a, 0x08,
+	0x53, 0x65, 0x76, 0x65, 0x72, 0x69, 0x74, 0x79, 0x12, 0x09, 0x0a, 0x05, 0x45, 0x52, 0x52, 0x4f,
+	0x52, 0x10, 0x00, 0x12, 0x0b, 0x0a, 0x07, 0x57, 0x41, 0x52, 0x4e, 0x49, 0x4e, 0x47, 0x10, 0x01,
+	0x22, 0x2e, 0x0a, 0x0a, 0x51, 0x75, 0x65, 0x72, 0x79, 0x53, 0x75, 0x69, 0x74, 0x65, 0x12, 0x20,
+	0x0a, 0x07, 0x71, 0x75, 0x65, 0x72, 0x69, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32,
+	0x06, 0x2e, 0x51, 0x75, 0x65, 0x72, 0x79, 0x52, 0x07, 0x71, 0x75, 0x65, 0x72, 0x69, 0x65, 0x73,
+	0x42, 0x0e, 0x5a, 0x0c, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x73, 0x2f, 0x71, 0x75, 0x65, 0x72, 0x79,
+	0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_query_proto_rawDescOnce sync.Once
+	file_query_proto_rawDescData = file_query_proto_rawDesc
+)
+
+func file_query_proto_rawDescGZIP() []byte {
+	file_query_proto_rawDescOnce.Do(func() {
+		file_query_proto_rawDescData = protoimpl.X.CompressGZIP(file_query_proto_rawDescData)
+	})
+	return file_query_proto_rawDescData
+}
+
+var file_query_proto_enumTypes = make([]protoimpl.EnumInfo, 1)
+var file_query_proto_msgTypes = make([]protoimpl.MessageInfo, 3)
+var file_query_proto_goTypes = []interface{}{
+	(Query_Severity)(0), // 0: Query.Severity
+	(*Query)(nil),       // 1: Query
+	(*QuerySuite)(nil),  // 2: QuerySuite
+	(*Query_Alert)(nil), // 3: Query.Alert
+}
+var file_query_proto_depIdxs = []int32{
+	3, // 0: Query.alerts:type_name -> Query.Alert
+	1, // 1: QuerySuite.queries:type_name -> Query
+	2, // [2:2] is the sub-list for method output_type
+	2, // [2:2] is the sub-list for method input_type
+	2, // [2:2] is the sub-list for extension type_name
+	2, // [2:2] is the sub-list for extension extendee
+	0, // [0:2] is the sub-list for field type_name
+}
+
+func init() { file_query_proto_init() }
+func file_query_proto_init() {
+	if File_query_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_query_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Query); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_query_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*QuerySuite); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_query_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Query_Alert); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_query_proto_rawDesc,
+			NumEnums:      1,
+			NumMessages:   3,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_query_proto_goTypes,
+		DependencyIndexes: file_query_proto_depIdxs,
+		EnumInfos:         file_query_proto_enumTypes,
+		MessageInfos:      file_query_proto_msgTypes,
+	}.Build()
+	File_query_proto = out.File
+	file_query_proto_rawDesc = nil
+	file_query_proto_goTypes = nil
+	file_query_proto_depIdxs = nil
+}

ql/test/library-tests/semmle/go/frameworks/Protobuf/protos/query.pb.go

@@ -0,0 +1,353 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.24.0-devel
+// 	protoc        v3.12.0
+// source: query.proto
+
+package protos
+
+import (
+	proto "github.com/golang/protobuf/proto"
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// This is a compile-time assertion that a sufficiently up-to-date version
+// of the legacy proto package is being used.
+const _ = proto.ProtoPackageIsVersion4
+
+type Query_Severity int32
+
+const (
+	Query_ERROR   Query_Severity = 0
+	Query_WARNING Query_Severity = 1
+)
+
+// Enum value maps for Query_Severity.
+var (
+	Query_Severity_name = map[int32]string{
+		0: "ERROR",
+		1: "WARNING",
+	}
+	Query_Severity_value = map[string]int32{
+		"ERROR":   0,
+		"WARNING": 1,
+	}
+)
+
+func (x Query_Severity) Enum() *Query_Severity {
+	p := new(Query_Severity)
+	*p = x
+	return p
+}
+
+func (x Query_Severity) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (Query_Severity) Descriptor() protoreflect.EnumDescriptor {
+	return file_query_proto_enumTypes[0].Descriptor()
+}
+
+func (Query_Severity) Type() protoreflect.EnumType {
+	return &file_query_proto_enumTypes[0]
+}
+
+func (x Query_Severity) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use Query_Severity.Descriptor instead.
+func (Query_Severity) EnumDescriptor() ([]byte, []int) {
+	return file_query_proto_rawDescGZIP(), []int{0, 0}
+}
+
+type Query struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Description string         `protobuf:"bytes,1,opt,name=description,proto3" json:"description,omitempty"`
+	Id          string         `protobuf:"bytes,2,opt,name=id,proto3" json:"id,omitempty"`
+	Alerts      []*Query_Alert `protobuf:"bytes,4,rep,name=alerts,proto3" json:"alerts,omitempty"`
+}
+
+func (x *Query) Reset() {
+	*x = Query{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_query_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Query) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Query) ProtoMessage() {}
+
+func (x *Query) ProtoReflect() protoreflect.Message {
+	mi := &file_query_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Query.ProtoReflect.Descriptor instead.
+func (*Query) Descriptor() ([]byte, []int) {
+	return file_query_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *Query) GetDescription() string {
+	if x != nil {
+		return x.Description
+	}
+	return ""
+}
+
+func (x *Query) GetId() string {
+	if x != nil {
+		return x.Id
+	}
+	return ""
+}
+
+func (x *Query) GetAlerts() []*Query_Alert {
+	if x != nil {
+		return x.Alerts
+	}
+	return nil
+}
+
+type QuerySuite struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Queries []*Query `protobuf:"bytes,1,rep,name=queries,proto3" json:"queries,omitempty"`
+}
+
+func (x *QuerySuite) Reset() {
+	*x = QuerySuite{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_query_proto_msgTypes[1]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *QuerySuite) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*QuerySuite) ProtoMessage() {}
+
+func (x *QuerySuite) ProtoReflect() protoreflect.Message {
+	mi := &file_query_proto_msgTypes[1]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use QuerySuite.ProtoReflect.Descriptor instead.
+func (*QuerySuite) Descriptor() ([]byte, []int) {
+	return file_query_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *QuerySuite) GetQueries() []*Query {
+	if x != nil {
+		return x.Queries
+	}
+	return nil
+}
+
+type Query_Alert struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Msg string `protobuf:"bytes,1,opt,name=msg,proto3" json:"msg,omitempty"`
+	Loc int64  `protobuf:"varint,2,opt,name=loc,proto3" json:"loc,omitempty"`
+}
+
+func (x *Query_Alert) Reset() {
+	*x = Query_Alert{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_query_proto_msgTypes[2]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Query_Alert) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Query_Alert) ProtoMessage() {}
+
+func (x *Query_Alert) ProtoReflect() protoreflect.Message {
+	mi := &file_query_proto_msgTypes[2]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Query_Alert.ProtoReflect.Descriptor instead.
+func (*Query_Alert) Descriptor() ([]byte, []int) {
+	return file_query_proto_rawDescGZIP(), []int{0, 0}
+}
+
+func (x *Query_Alert) GetMsg() string {
+	if x != nil {
+		return x.Msg
+	}
+	return ""
+}
+
+func (x *Query_Alert) GetLoc() int64 {
+	if x != nil {
+		return x.Loc
+	}
+	return 0
+}
+
+var File_query_proto protoreflect.FileDescriptor
+
+var file_query_proto_rawDesc = []byte{
+	0x0a, 0x0b, 0x71, 0x75, 0x65, 0x72, 0x79, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0xb0, 0x01,
+	0x0a, 0x05, 0x51, 0x75, 0x65, 0x72, 0x79, 0x12, 0x20, 0x0a, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72,
+	0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x64, 0x65,
+	0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x24, 0x0a, 0x06, 0x61, 0x6c, 0x65,
+	0x72, 0x74, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x0c, 0x2e, 0x51, 0x75, 0x65, 0x72,
+	0x79, 0x2e, 0x41, 0x6c, 0x65, 0x72, 0x74, 0x52, 0x06, 0x61, 0x6c, 0x65, 0x72, 0x74, 0x73, 0x1a,
+	0x2b, 0x0a, 0x05, 0x41, 0x6c, 0x65, 0x72, 0x74, 0x12, 0x10, 0x0a, 0x03, 0x6d, 0x73, 0x67, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6d, 0x73, 0x67, 0x12, 0x10, 0x0a, 0x03, 0x6c, 0x6f,
+	0x63, 0x18, 0x02, 0x20, 0x01, 0x28, 0x03, 0x52, 0x03, 0x6c, 0x6f, 0x63, 0x22, 0x22, 0x0a, 0x08,
+	0x53, 0x65, 0x76, 0x65, 0x72, 0x69, 0x74, 0x79, 0x12, 0x09, 0x0a, 0x05, 0x45, 0x52, 0x52, 0x4f,
+	0x52, 0x10, 0x00, 0x12, 0x0b, 0x0a, 0x07, 0x57, 0x41, 0x52, 0x4e, 0x49, 0x4e, 0x47, 0x10, 0x01,
+	0x22, 0x2e, 0x0a, 0x0a, 0x51, 0x75, 0x65, 0x72, 0x79, 0x53, 0x75, 0x69, 0x74, 0x65, 0x12, 0x20,
+	0x0a, 0x07, 0x71, 0x75, 0x65, 0x72, 0x69, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32,
+	0x06, 0x2e, 0x51, 0x75, 0x65, 0x72, 0x79, 0x52, 0x07, 0x71, 0x75, 0x65, 0x72, 0x69, 0x65, 0x73,
+	0x42, 0x08, 0x5a, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x73, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74,
+	0x6f, 0x33,
+}
+
+var (
+	file_query_proto_rawDescOnce sync.Once
+	file_query_proto_rawDescData = file_query_proto_rawDesc
+)
+
+func file_query_proto_rawDescGZIP() []byte {
+	file_query_proto_rawDescOnce.Do(func() {
+		file_query_proto_rawDescData = protoimpl.X.CompressGZIP(file_query_proto_rawDescData)
+	})
+	return file_query_proto_rawDescData
+}
+
+var file_query_proto_enumTypes = make([]protoimpl.EnumInfo, 1)
+var file_query_proto_msgTypes = make([]protoimpl.MessageInfo, 3)
+var file_query_proto_goTypes = []interface{}{
+	(Query_Severity)(0), // 0: Query.Severity
+	(*Query)(nil),       // 1: Query
+	(*QuerySuite)(nil),  // 2: QuerySuite
+	(*Query_Alert)(nil), // 3: Query.Alert
+}
+var file_query_proto_depIdxs = []int32{
+	3, // 0: Query.alerts:type_name -> Query.Alert
+	1, // 1: QuerySuite.queries:type_name -> Query
+	2, // [2:2] is the sub-list for method output_type
+	2, // [2:2] is the sub-list for method input_type
+	2, // [2:2] is the sub-list for extension type_name
+	2, // [2:2] is the sub-list for extension extendee
+	0, // [0:2] is the sub-list for field type_name
+}
+
+func init() { file_query_proto_init() }
+func file_query_proto_init() {
+	if File_query_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_query_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Query); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_query_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*QuerySuite); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_query_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Query_Alert); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_query_proto_rawDesc,
+			NumEnums:      1,
+			NumMessages:   3,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_query_proto_goTypes,
+		DependencyIndexes: file_query_proto_depIdxs,
+		EnumInfos:         file_query_proto_enumTypes,
+		MessageInfos:      file_query_proto_msgTypes,
+	}.Build()
+	File_query_proto = out.File
+	file_query_proto_rawDesc = nil
+	file_query_proto_goTypes = nil
+	file_query_proto_depIdxs = nil
+}

ql/test/library-tests/semmle/go/frameworks/Protobuf/protos/query.proto

@@ -0,0 +1,23 @@
+syntax = "proto3";
+option go_package = "protos/query";
+
+message Query {
+  string description = 1;
+  string id = 2;
+
+  enum Severity {
+    ERROR = 0;
+    WARNING = 1;
+  }
+
+  message Alert {
+    string msg = 1;
+    int64 loc = 2;
+  }
+
+  repeated Alert alerts = 4;
+}
+
+message QuerySuite {
+  repeated Query queries = 1;
+}

ql/test/library-tests/semmle/go/frameworks/Protobuf/protos/query/query.pb.go

@@ -0,0 +1,353 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.24.0-devel
+// 	protoc        v3.12.0
+// source: query.proto
+
+package query
+
+import (
+	proto "github.com/golang/protobuf/proto"
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// This is a compile-time assertion that a sufficiently up-to-date version
+// of the legacy proto package is being used.
+const _ = proto.ProtoPackageIsVersion4
+
+type Query_Severity int32
+
+const (
+	Query_ERROR   Query_Severity = 0
+	Query_WARNING Query_Severity = 1
+)
+
+// Enum value maps for Query_Severity.
+var (
+	Query_Severity_name = map[int32]string{
+		0: "ERROR",
+		1: "WARNING",
+	}
+	Query_Severity_value = map[string]int32{
+		"ERROR":   0,
+		"WARNING": 1,
+	}
+)
+
+func (x Query_Severity) Enum() *Query_Severity {
+	p := new(Query_Severity)
+	*p = x
+	return p
+}
+
+func (x Query_Severity) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (Query_Severity) Descriptor() protoreflect.EnumDescriptor {
+	return file_query_proto_enumTypes[0].Descriptor()
+}
+
+func (Query_Severity) Type() protoreflect.EnumType {
+	return &file_query_proto_enumTypes[0]
+}
+
+func (x Query_Severity) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use Query_Severity.Descriptor instead.
+func (Query_Severity) EnumDescriptor() ([]byte, []int) {
+	return file_query_proto_rawDescGZIP(), []int{0, 0}
+}
+
+type Query struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Description string         `protobuf:"bytes,1,opt,name=description,proto3" json:"description,omitempty"`
+	Id          string         `protobuf:"bytes,2,opt,name=id,proto3" json:"id,omitempty"`
+	Alerts      []*Query_Alert `protobuf:"bytes,4,rep,name=alerts,proto3" json:"alerts,omitempty"`
+}
+
+func (x *Query) Reset() {
+	*x = Query{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_query_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Query) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Query) ProtoMessage() {}
+
+func (x *Query) ProtoReflect() protoreflect.Message {
+	mi := &file_query_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Query.ProtoReflect.Descriptor instead.
+func (*Query) Descriptor() ([]byte, []int) {
+	return file_query_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *Query) GetDescription() string {
+	if x != nil {
+		return x.Description
+	}
+	return ""
+}
+
+func (x *Query) GetId() string {
+	if x != nil {
+		return x.Id
+	}
+	return ""
+}
+
+func (x *Query) GetAlerts() []*Query_Alert {
+	if x != nil {
+		return x.Alerts
+	}
+	return nil
+}
+
+type QuerySuite struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Queries []*Query `protobuf:"bytes,1,rep,name=queries,proto3" json:"queries,omitempty"`
+}
+
+func (x *QuerySuite) Reset() {
+	*x = QuerySuite{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_query_proto_msgTypes[1]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *QuerySuite) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*QuerySuite) ProtoMessage() {}
+
+func (x *QuerySuite) ProtoReflect() protoreflect.Message {
+	mi := &file_query_proto_msgTypes[1]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use QuerySuite.ProtoReflect.Descriptor instead.
+func (*QuerySuite) Descriptor() ([]byte, []int) {
+	return file_query_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *QuerySuite) GetQueries() []*Query {
+	if x != nil {
+		return x.Queries
+	}
+	return nil
+}
+
+type Query_Alert struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Msg string `protobuf:"bytes,1,opt,name=msg,proto3" json:"msg,omitempty"`
+	Loc int64  `protobuf:"varint,2,opt,name=loc,proto3" json:"loc,omitempty"`
+}
+
+func (x *Query_Alert) Reset() {
+	*x = Query_Alert{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_query_proto_msgTypes[2]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Query_Alert) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Query_Alert) ProtoMessage() {}
+
+func (x *Query_Alert) ProtoReflect() protoreflect.Message {
+	mi := &file_query_proto_msgTypes[2]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Query_Alert.ProtoReflect.Descriptor instead.
+func (*Query_Alert) Descriptor() ([]byte, []int) {
+	return file_query_proto_rawDescGZIP(), []int{0, 0}
+}
+
+func (x *Query_Alert) GetMsg() string {
+	if x != nil {
+		return x.Msg
+	}
+	return ""
+}
+
+func (x *Query_Alert) GetLoc() int64 {
+	if x != nil {
+		return x.Loc
+	}
+	return 0
+}
+
+var File_query_proto protoreflect.FileDescriptor
+
+var file_query_proto_rawDesc = []byte{
+	0x0a, 0x0b, 0x71, 0x75, 0x65, 0x72, 0x79, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0xb0, 0x01,
+	0x0a, 0x05, 0x51, 0x75, 0x65, 0x72, 0x79, 0x12, 0x20, 0x0a, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72,
+	0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x64, 0x65,
+	0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x24, 0x0a, 0x06, 0x61, 0x6c, 0x65,
+	0x72, 0x74, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x0c, 0x2e, 0x51, 0x75, 0x65, 0x72,
+	0x79, 0x2e, 0x41, 0x6c, 0x65, 0x72, 0x74, 0x52, 0x06, 0x61, 0x6c, 0x65, 0x72, 0x74, 0x73, 0x1a,
+	0x2b, 0x0a, 0x05, 0x41, 0x6c, 0x65, 0x72, 0x74, 0x12, 0x10, 0x0a, 0x03, 0x6d, 0x73, 0x67, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6d, 0x73, 0x67, 0x12, 0x10, 0x0a, 0x03, 0x6c, 0x6f,
+	0x63, 0x18, 0x02, 0x20, 0x01, 0x28, 0x03, 0x52, 0x03, 0x6c, 0x6f, 0x63, 0x22, 0x22, 0x0a, 0x08,
+	0x53, 0x65, 0x76, 0x65, 0x72, 0x69, 0x74, 0x79, 0x12, 0x09, 0x0a, 0x05, 0x45, 0x52, 0x52, 0x4f,
+	0x52, 0x10, 0x00, 0x12, 0x0b, 0x0a, 0x07, 0x57, 0x41, 0x52, 0x4e, 0x49, 0x4e, 0x47, 0x10, 0x01,
+	0x22, 0x2e, 0x0a, 0x0a, 0x51, 0x75, 0x65, 0x72, 0x79, 0x53, 0x75, 0x69, 0x74, 0x65, 0x12, 0x20,
+	0x0a, 0x07, 0x71, 0x75, 0x65, 0x72, 0x69, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32,
+	0x06, 0x2e, 0x51, 0x75, 0x65, 0x72, 0x79, 0x52, 0x07, 0x71, 0x75, 0x65, 0x72, 0x69, 0x65, 0x73,
+	0x42, 0x0e, 0x5a, 0x0c, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x73, 0x2f, 0x71, 0x75, 0x65, 0x72, 0x79,
+	0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_query_proto_rawDescOnce sync.Once
+	file_query_proto_rawDescData = file_query_proto_rawDesc
+)
+
+func file_query_proto_rawDescGZIP() []byte {
+	file_query_proto_rawDescOnce.Do(func() {
+		file_query_proto_rawDescData = protoimpl.X.CompressGZIP(file_query_proto_rawDescData)
+	})
+	return file_query_proto_rawDescData
+}
+
+var file_query_proto_enumTypes = make([]protoimpl.EnumInfo, 1)
+var file_query_proto_msgTypes = make([]protoimpl.MessageInfo, 3)
+var file_query_proto_goTypes = []interface{}{
+	(Query_Severity)(0), // 0: Query.Severity
+	(*Query)(nil),       // 1: Query
+	(*QuerySuite)(nil),  // 2: QuerySuite
+	(*Query_Alert)(nil), // 3: Query.Alert
+}
+var file_query_proto_depIdxs = []int32{
+	3, // 0: Query.alerts:type_name -> Query.Alert
+	1, // 1: QuerySuite.queries:type_name -> Query
+	2, // [2:2] is the sub-list for method output_type
+	2, // [2:2] is the sub-list for method input_type
+	2, // [2:2] is the sub-list for extension type_name
+	2, // [2:2] is the sub-list for extension extendee
+	0, // [0:2] is the sub-list for field type_name
+}
+
+func init() { file_query_proto_init() }
+func file_query_proto_init() {
+	if File_query_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_query_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Query); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_query_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*QuerySuite); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_query_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Query_Alert); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_query_proto_rawDesc,
+			NumEnums:      1,
+			NumMessages:   3,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_query_proto_goTypes,
+		DependencyIndexes: file_query_proto_depIdxs,
+		EnumInfos:         file_query_proto_enumTypes,
+		MessageInfos:      file_query_proto_msgTypes,
+	}.Build()
+	File_query_proto = out.File
+	file_query_proto_rawDesc = nil
+	file_query_proto_goTypes = nil
+	file_query_proto_depIdxs = nil
+}

ql/test/library-tests/semmle/go/frameworks/Protobuf/vendor/github.com/golang/protobuf/LICENSE

@@ -0,0 +1,28 @@
+Copyright 2010 The Go Authors.  All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are
+met:
+
+    * Redistributions of source code must retain the above copyright
+notice, this list of conditions and the following disclaimer.
+    * Redistributions in binary form must reproduce the above
+copyright notice, this list of conditions and the following disclaimer
+in the documentation and/or other materials provided with the
+distribution.
+    * Neither the name of Google Inc. nor the names of its
+contributors may be used to endorse or promote products derived from
+this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+

ql/test/library-tests/semmle/go/frameworks/Protobuf/vendor/github.com/golang/protobuf/proto/stub.go

@@ -0,0 +1,24 @@
+// Code generated by depstubber. DO NOT EDIT.
+// This is a simple stub for github.com/golang/protobuf/proto, strictly for use in testing.
+
+// See the LICENSE file for information about the licensing of the original library.
+// Source: github.com/golang/protobuf/proto (exports: Message; functions: Marshal,Unmarshal,ProtoPackageIsVersion4)
+
+// Package proto is a stub of github.com/golang/protobuf/proto, generated by depstubber.
+package proto
+
+import (
+	protoiface "google.golang.org/protobuf/runtime/protoiface"
+)
+
+func Marshal(_ interface{}) ([]byte, error) {
+	return nil, nil
+}
+
+type Message = protoiface.MessageV1
+
+var ProtoPackageIsVersion4 bool = false
+
+func Unmarshal(_ []byte, _ interface{}) error {
+	return nil
+}

ql/test/library-tests/semmle/go/frameworks/Protobuf/vendor/google.golang.org/protobuf/LICENSE

@@ -0,0 +1,27 @@
+Copyright (c) 2018 The Go Authors. All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are
+met:
+
+   * Redistributions of source code must retain the above copyright
+notice, this list of conditions and the following disclaimer.
+   * Redistributions in binary form must reproduce the above
+copyright notice, this list of conditions and the following disclaimer
+in the documentation and/or other materials provided with the
+distribution.
+   * Neither the name of Google Inc. nor the names of its
+contributors may be used to endorse or promote products derived from
+this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

ql/test/library-tests/semmle/go/frameworks/Protobuf/vendor/google.golang.org/protobuf/internal/impl/stub.go

@@ -0,0 +1,18 @@
+// Code generated by depstubber. DO NOT EDIT.
+// This is a simple stub for google.golang.org/protobuf/internal/impl, strictly for use in testing.
+
+// See the LICENSE file for information about the licensing of the original library.
+// Source: google.golang.org/protobuf/internal/impl (exports: MessageState,Pointer; functions: )
+
+// Package impl is a stub of google.golang.org/protobuf/internal/impl, generated by depstubber.
+package impl
+
+import ()
+
+type MessageState struct {
+	NoUnkeyedLiterals interface{}
+	DoNotCompare      interface{}
+	DoNotCopy         interface{}
+}
+
+type Pointer interface{}

ql/test/library-tests/semmle/go/frameworks/Protobuf/vendor/google.golang.org/protobuf/reflect/protoreflect/stub.go

@@ -0,0 +1,681 @@
+// Code generated by depstubber. DO NOT EDIT.
+// This is a simple stub for google.golang.org/protobuf/reflect/protoreflect, strictly for use in testing.
+
+// See the LICENSE file for information about the licensing of the original library.
+// Source: google.golang.org/protobuf/reflect/protoreflect (exports: EnumDescriptor,EnumType,EnumNumber,Message,FileDescriptor; functions: )
+
+// Package protoreflect is a stub of google.golang.org/protobuf/reflect/protoreflect, generated by depstubber.
+package protoreflect
+
+import ()
+
+type Cardinality int8
+
+func (_ Cardinality) GoString() string {
+	return ""
+}
+
+func (_ Cardinality) IsValid() bool {
+	return false
+}
+
+func (_ Cardinality) String() string {
+	return ""
+}
+
+type Descriptor interface {
+	FullName() FullName
+	Index() int
+	IsPlaceholder() bool
+	Name() Name
+	Options() ProtoMessage
+	Parent() Descriptor
+	ParentFile() FileDescriptor
+	ProtoInternal(_ interface{})
+	Syntax() Syntax
+}
+
+type Enum interface {
+	Descriptor() EnumDescriptor
+	Number() EnumNumber
+	Type() EnumType
+}
+
+type EnumDescriptor interface {
+	FullName() FullName
+	Index() int
+	IsPlaceholder() bool
+	Name() Name
+	Options() ProtoMessage
+	Parent() Descriptor
+	ParentFile() FileDescriptor
+	ProtoInternal(_ interface{})
+	ProtoType(_ EnumDescriptor)
+	ReservedNames() Names
+	ReservedRanges() EnumRanges
+	Syntax() Syntax
+	Values() EnumValueDescriptors
+}
+
+type EnumDescriptors interface {
+	ByName(_ Name) EnumDescriptor
+	Get(_ int) EnumDescriptor
+	Len() int
+	ProtoInternal(_ interface{})
+}
+
+type EnumNumber int32
+
+type EnumRanges interface {
+	Get(_ int) [2]EnumNumber
+	Has(_ EnumNumber) bool
+	Len() int
+	ProtoInternal(_ interface{})
+}
+
+type EnumType interface {
+	Descriptor() EnumDescriptor
+	New(_ EnumNumber) Enum
+}
+
+type EnumValueDescriptor interface {
+	FullName() FullName
+	Index() int
+	IsPlaceholder() bool
+	Name() Name
+	Number() EnumNumber
+	Options() ProtoMessage
+	Parent() Descriptor
+	ParentFile() FileDescriptor
+	ProtoInternal(_ interface{})
+	ProtoType(_ EnumValueDescriptor)
+	Syntax() Syntax
+}
+
+type EnumValueDescriptors interface {
+	ByName(_ Name) EnumValueDescriptor
+	ByNumber(_ EnumNumber) EnumValueDescriptor
+	Get(_ int) EnumValueDescriptor
+	Len() int
+	ProtoInternal(_ interface{})
+}
+
+type ExtensionDescriptors interface {
+	ByName(_ Name) FieldDescriptor
+	Get(_ int) FieldDescriptor
+	Len() int
+	ProtoInternal(_ interface{})
+}
+
+type ExtensionType interface {
+	InterfaceOf(_ Value) interface{}
+	IsValidInterface(_ interface{}) bool
+	IsValidValue(_ Value) bool
+	New() Value
+	TypeDescriptor() ExtensionTypeDescriptor
+	ValueOf(_ interface{}) Value
+	Zero() Value
+}
+
+type ExtensionTypeDescriptor interface {
+	Cardinality() Cardinality
+	ContainingMessage() MessageDescriptor
+	ContainingOneof() OneofDescriptor
+	Default() Value
+	DefaultEnumValue() EnumValueDescriptor
+	Descriptor() FieldDescriptor
+	Enum() EnumDescriptor
+	FullName() FullName
+	HasDefault() bool
+	HasJSONName() bool
+	HasOptionalKeyword() bool
+	HasPresence() bool
+	Index() int
+	IsExtension() bool
+	IsList() bool
+	IsMap() bool
+	IsPacked() bool
+	IsPlaceholder() bool
+	IsWeak() bool
+	JSONName() string
+	Kind() Kind
+	MapKey() FieldDescriptor
+	MapValue() FieldDescriptor
+	Message() MessageDescriptor
+	Name() Name
+	Number() interface{}
+	Options() ProtoMessage
+	Parent() Descriptor
+	ParentFile() FileDescriptor
+	ProtoInternal(_ interface{})
+	ProtoType(_ FieldDescriptor)
+	Syntax() Syntax
+	Type() ExtensionType
+}
+
+type FieldDescriptor interface {
+	Cardinality() Cardinality
+	ContainingMessage() MessageDescriptor
+	ContainingOneof() OneofDescriptor
+	Default() Value
+	DefaultEnumValue() EnumValueDescriptor
+	Enum() EnumDescriptor
+	FullName() FullName
+	HasDefault() bool
+	HasJSONName() bool
+	HasOptionalKeyword() bool
+	HasPresence() bool
+	Index() int
+	IsExtension() bool
+	IsList() bool
+	IsMap() bool
+	IsPacked() bool
+	IsPlaceholder() bool
+	IsWeak() bool
+	JSONName() string
+	Kind() Kind
+	MapKey() FieldDescriptor
+	MapValue() FieldDescriptor
+	Message() MessageDescriptor
+	Name() Name
+	Number() interface{}
+	Options() ProtoMessage
+	Parent() Descriptor
+	ParentFile() FileDescriptor
+	ProtoInternal(_ interface{})
+	ProtoType(_ FieldDescriptor)
+	Syntax() Syntax
+}
+
+type FieldDescriptors interface {
+	ByJSONName(_ string) FieldDescriptor
+	ByName(_ Name) FieldDescriptor
+	ByNumber(_ interface{}) FieldDescriptor
+	Get(_ int) FieldDescriptor
+	Len() int
+	ProtoInternal(_ interface{})
+}
+
+type FieldNumbers interface {
+	Get(_ int) interface{}
+	Has(_ interface{}) bool
+	Len() int
+	ProtoInternal(_ interface{})
+}
+
+type FieldRanges interface {
+	Get(_ int) [2]interface{}
+	Has(_ interface{}) bool
+	Len() int
+	ProtoInternal(_ interface{})
+}
+
+type FileDescriptor interface {
+	Enums() EnumDescriptors
+	Extensions() ExtensionDescriptors
+	FullName() FullName
+	Imports() FileImports
+	Index() int
+	IsPlaceholder() bool
+	Messages() MessageDescriptors
+	Name() Name
+	Options() ProtoMessage
+	Package() FullName
+	Parent() Descriptor
+	ParentFile() FileDescriptor
+	Path() string
+	ProtoInternal(_ interface{})
+	ProtoType(_ FileDescriptor)
+	Services() ServiceDescriptors
+	SourceLocations() SourceLocations
+	Syntax() Syntax
+}
+
+type FileImport struct {
+	FileDescriptor FileDescriptor
+	IsPublic       bool
+	IsWeak         bool
+}
+
+func (_ FileImport) Enums() EnumDescriptors {
+	return nil
+}
+
+func (_ FileImport) Extensions() ExtensionDescriptors {
+	return nil
+}
+
+func (_ FileImport) FullName() FullName {
+	return ""
+}
+
+func (_ FileImport) Imports() FileImports {
+	return nil
+}
+
+func (_ FileImport) Index() int {
+	return 0
+}
+
+func (_ FileImport) IsPlaceholder() bool {
+	return false
+}
+
+func (_ FileImport) Messages() MessageDescriptors {
+	return nil
+}
+
+func (_ FileImport) Name() Name {
+	return ""
+}
+
+func (_ FileImport) Options() ProtoMessage {
+	return nil
+}
+
+func (_ FileImport) Package() FullName {
+	return ""
+}
+
+func (_ FileImport) Parent() Descriptor {
+	return nil
+}
+
+func (_ FileImport) ParentFile() FileDescriptor {
+	return nil
+}
+
+func (_ FileImport) Path() string {
+	return ""
+}
+
+func (_ FileImport) ProtoInternal(_ interface{}) {}
+
+func (_ FileImport) ProtoType(_ FileDescriptor) {}
+
+func (_ FileImport) Services() ServiceDescriptors {
+	return nil
+}
+
+func (_ FileImport) SourceLocations() SourceLocations {
+	return nil
+}
+
+func (_ FileImport) Syntax() Syntax {
+	return 0
+}
+
+type FileImports interface {
+	Get(_ int) FileImport
+	Len() int
+	ProtoInternal(_ interface{})
+}
+
+type FullName string
+
+func (_ FullName) Append(_ Name) FullName {
+	return ""
+}
+
+func (_ FullName) IsValid() bool {
+	return false
+}
+
+func (_ FullName) Name() Name {
+	return ""
+}
+
+func (_ FullName) Parent() FullName {
+	return ""
+}
+
+type Kind int8
+
+func (_ Kind) GoString() string {
+	return ""
+}
+
+func (_ Kind) IsValid() bool {
+	return false
+}
+
+func (_ Kind) String() string {
+	return ""
+}
+
+type List interface {
+	Append(_ Value)
+	AppendMutable() Value
+	Get(_ int) Value
+	IsValid() bool
+	Len() int
+	NewElement() Value
+	Set(_ int, _ Value)
+	Truncate(_ int)
+}
+
+type Map interface {
+	Clear(_ MapKey)
+	Get(_ MapKey) Value
+	Has(_ MapKey) bool
+	IsValid() bool
+	Len() int
+	Mutable(_ MapKey) Value
+	NewValue() Value
+	Range(_ func(MapKey, Value) bool)
+	Set(_ MapKey, _ Value)
+}
+
+type MapKey struct {
+	DoNotCompare interface{}
+}
+
+func (_ MapKey) Bool() bool {
+	return false
+}
+
+func (_ MapKey) Int() int64 {
+	return 0
+}
+
+func (_ MapKey) Interface() interface{} {
+	return nil
+}
+
+func (_ MapKey) IsValid() bool {
+	return false
+}
+
+func (_ MapKey) String() string {
+	return ""
+}
+
+func (_ MapKey) Uint() uint64 {
+	return 0
+}
+
+func (_ MapKey) Value() Value {
+	return Value{}
+}
+
+type Message interface {
+	Clear(_ FieldDescriptor)
+	Descriptor() MessageDescriptor
+	Get(_ FieldDescriptor) Value
+	GetUnknown() RawFields
+	Has(_ FieldDescriptor) bool
+	Interface() ProtoMessage
+	IsValid() bool
+	Mutable(_ FieldDescriptor) Value
+	New() Message
+	NewField(_ FieldDescriptor) Value
+	ProtoMethods() *struct {
+		NoUnkeyedLiterals interface{}
+		Flags             uint64
+		Size              func(struct {
+			NoUnkeyedLiterals interface{}
+			Message           Message
+			Flags             byte
+		}) struct {
+			NoUnkeyedLiterals interface{}
+			Size              int
+		}
+		Marshal func(struct {
+			NoUnkeyedLiterals interface{}
+			Message           Message
+			Buf               []byte
+			Flags             byte
+		}) (struct {
+			NoUnkeyedLiterals interface{}
+			Buf               []byte
+		}, error)
+		Unmarshal func(struct {
+			NoUnkeyedLiterals interface{}
+			Message           Message
+			Buf               []byte
+			Flags             byte
+			Resolver          interface {
+				FindExtensionByName(_ FullName) (ExtensionType, error)
+				FindExtensionByNumber(_ FullName, _ interface{}) (ExtensionType, error)
+			}
+		}) (struct {
+			NoUnkeyedLiterals interface{}
+			Flags             byte
+		}, error)
+		Merge func(struct {
+			NoUnkeyedLiterals interface{}
+			Source            Message
+			Destination       Message
+		}) struct {
+			NoUnkeyedLiterals interface{}
+			Flags             byte
+		}
+		CheckInitialized func(struct {
+			NoUnkeyedLiterals interface{}
+			Message           Message
+		}) (struct {
+			NoUnkeyedLiterals interface{}
+		}, error)
+	}
+	Range(_ func(FieldDescriptor, Value) bool)
+	Set(_ FieldDescriptor, _ Value)
+	SetUnknown(_ RawFields)
+	Type() MessageType
+	WhichOneof(_ OneofDescriptor) FieldDescriptor
+}
+
+type MessageDescriptor interface {
+	Enums() EnumDescriptors
+	ExtensionRangeOptions(_ int) ProtoMessage
+	ExtensionRanges() FieldRanges
+	Extensions() ExtensionDescriptors
+	Fields() FieldDescriptors
+	FullName() FullName
+	Index() int
+	IsMapEntry() bool
+	IsPlaceholder() bool
+	Messages() MessageDescriptors
+	Name() Name
+	Oneofs() OneofDescriptors
+	Options() ProtoMessage
+	Parent() Descriptor
+	ParentFile() FileDescriptor
+	ProtoInternal(_ interface{})
+	ProtoType(_ MessageDescriptor)
+	RequiredNumbers() FieldNumbers
+	ReservedNames() Names
+	ReservedRanges() FieldRanges
+	Syntax() Syntax
+}
+
+type MessageDescriptors interface {
+	ByName(_ Name) MessageDescriptor
+	Get(_ int) MessageDescriptor
+	Len() int
+	ProtoInternal(_ interface{})
+}
+
+type MessageType interface {
+	Descriptor() MessageDescriptor
+	New() Message
+	Zero() Message
+}
+
+type MethodDescriptor interface {
+	FullName() FullName
+	Index() int
+	Input() MessageDescriptor
+	IsPlaceholder() bool
+	IsStreamingClient() bool
+	IsStreamingServer() bool
+	Name() Name
+	Options() ProtoMessage
+	Output() MessageDescriptor
+	Parent() Descriptor
+	ParentFile() FileDescriptor
+	ProtoInternal(_ interface{})
+	ProtoType(_ MethodDescriptor)
+	Syntax() Syntax
+}
+
+type MethodDescriptors interface {
+	ByName(_ Name) MethodDescriptor
+	Get(_ int) MethodDescriptor
+	Len() int
+	ProtoInternal(_ interface{})
+}
+
+type Name string
+
+func (_ Name) IsValid() bool {
+	return false
+}
+
+type Names interface {
+	Get(_ int) Name
+	Has(_ Name) bool
+	Len() int
+	ProtoInternal(_ interface{})
+}
+
+type OneofDescriptor interface {
+	Fields() FieldDescriptors
+	FullName() FullName
+	Index() int
+	IsPlaceholder() bool
+	IsSynthetic() bool
+	Name() Name
+	Options() ProtoMessage
+	Parent() Descriptor
+	ParentFile() FileDescriptor
+	ProtoInternal(_ interface{})
+	ProtoType(_ OneofDescriptor)
+	Syntax() Syntax
+}
+
+type OneofDescriptors interface {
+	ByName(_ Name) OneofDescriptor
+	Get(_ int) OneofDescriptor
+	Len() int
+	ProtoInternal(_ interface{})
+}
+
+type ProtoMessage interface {
+	ProtoReflect() Message
+}
+
+type RawFields []byte
+
+func (_ RawFields) IsValid() bool {
+	return false
+}
+
+type ServiceDescriptor interface {
+	FullName() FullName
+	Index() int
+	IsPlaceholder() bool
+	Methods() MethodDescriptors
+	Name() Name
+	Options() ProtoMessage
+	Parent() Descriptor
+	ParentFile() FileDescriptor
+	ProtoInternal(_ interface{})
+	ProtoType(_ ServiceDescriptor)
+	Syntax() Syntax
+}
+
+type ServiceDescriptors interface {
+	ByName(_ Name) ServiceDescriptor
+	Get(_ int) ServiceDescriptor
+	Len() int
+	ProtoInternal(_ interface{})
+}
+
+type SourceLocation struct {
+	Path                    SourcePath
+	StartLine               int
+	StartColumn             int
+	EndLine                 int
+	EndColumn               int
+	LeadingDetachedComments []string
+	LeadingComments         string
+	TrailingComments        string
+}
+
+type SourceLocations interface {
+	Get(_ int) SourceLocation
+	Len() int
+	ProtoInternal(_ interface{})
+}
+
+type SourcePath []int32
+
+type Syntax int8
+
+func (_ Syntax) GoString() string {
+	return ""
+}
+
+func (_ Syntax) IsValid() bool {
+	return false
+}
+
+func (_ Syntax) String() string {
+	return ""
+}
+
+type Value struct {
+	DoNotCompare interface{}
+}
+
+func (_ Value) Bool() bool {
+	return false
+}
+
+func (_ Value) Bytes() []byte {
+	return nil
+}
+
+func (_ Value) Enum() EnumNumber {
+	return 0
+}
+
+func (_ Value) Float() float64 {
+	return 0
+}
+
+func (_ Value) Int() int64 {
+	return 0
+}
+
+func (_ Value) Interface() interface{} {
+	return nil
+}
+
+func (_ Value) IsValid() bool {
+	return false
+}
+
+func (_ Value) List() List {
+	return nil
+}
+
+func (_ Value) Map() Map {
+	return nil
+}
+
+func (_ Value) MapKey() MapKey {
+	return MapKey{}
+}
+
+func (_ Value) Message() Message {
+	return nil
+}
+
+func (_ Value) String() string {
+	return ""
+}
+
+func (_ Value) Uint() uint64 {
+	return 0
+}

ql/test/library-tests/semmle/go/frameworks/Protobuf/vendor/google.golang.org/protobuf/runtime/protoiface/stub.go

@@ -0,0 +1,16 @@
+// Code generated by depstubber. DO NOT EDIT.
+// This is a simple stub for google.golang.org/protobuf/runtime/protoiface, strictly for use in testing.
+
+// See the LICENSE file for information about the licensing of the original library.
+// Source: google.golang.org/protobuf/runtime/protoiface (exports: MessageV1; functions: )
+
+// Package protoiface is a stub of google.golang.org/protobuf/runtime/protoiface, generated by depstubber.
+package protoiface
+
+import ()
+
+type MessageV1 interface {
+	ProtoMessage()
+	Reset()
+	String() string
+}

ql/test/library-tests/semmle/go/frameworks/Protobuf/vendor/google.golang.org/protobuf/runtime/protoimpl/stub.go

@@ -0,0 +1,91 @@
+// This is a simple stub for google.golang.org/protobuf/runtime/protoimpl, strictly for use in testing.
+
+// See the LICENSE file for information about the licensing of the original library.
+// Source: google.golang.org/protobuf/runtime/protoimpl (exports: MessageState,SizeCache,UnknownFields,Pointer,EnforceVersion; functions: MinVersion,MaxVersion,UnsafeEnabled,X)
+
+// Package protoimpl is a stub of google.golang.org/protobuf/runtime/protoimpl.
+package protoimpl
+
+import (
+	impl "google.golang.org/protobuf/internal/impl"
+)
+
+type EnforceVersion uint
+
+var MaxVersion int = 0
+
+type MessageState = impl.MessageState
+
+var MinVersion int = 0
+
+type Pointer = impl.Pointer
+
+type SizeCache = int32
+
+type UnknownFields = []byte
+
+var UnsafeEnabled bool = false
+
+// Export is a zero-length named type that exists only to export a set of
+// functions that we do not want to appear in godoc.
+type Export struct{}
+
+var X Export = Export{}
+
+func (Export) NewError(f string, x ...interface{}) error {
+	return nil
+}
+
+type enum = interface{}
+
+func (Export) EnumOf(e enum) interface{} {
+	return nil
+}
+
+func (Export) EnumDescriptorOf(e enum) interface{} {
+	return nil
+}
+
+func (Export) EnumTypeOf(e enum) interface{} {
+	return nil
+}
+
+func (Export) EnumStringOf(ed interface{}, n interface{}) string {
+	return ""
+}
+
+type message = interface{}
+
+type legacyMessageWrapper struct{ m interface{} }
+
+func (m legacyMessageWrapper) Reset()         {}
+func (m legacyMessageWrapper) String() string { return "" }
+func (m legacyMessageWrapper) ProtoMessage()  {}
+
+func (Export) ProtoMessageV1Of(m message) interface{} {
+	return nil
+}
+
+func (Export) protoMessageV2Of(m message) interface{} {
+	return nil
+}
+
+func (Export) ProtoMessageV2Of(m message) interface{} {
+	return nil
+}
+
+func (Export) MessageOf(m message) interface{} {
+	return nil
+}
+
+func (Export) MessageDescriptorOf(m message) interface{} {
+	return nil
+}
+
+func (Export) MessageTypeOf(m message) interface{} {
+	return nil
+}
+
+func (Export) MessageStringOf(m interface{}) string {
+	return ""
+}

ql/test/library-tests/semmle/go/frameworks/Protobuf/vendor/modules.txt

@@ -0,0 +1,6 @@
+# github.com/golang/protobuf v1.4.2
+## explicit
+github.com/golang/protobuf
+# google.golang.org/protobuf v1.23.0
+## explicit
+google.golang.org/protobuf